Is There a Virus Under Your Tree.exe?
Dateline: 12/23/98Just in time for the holidays, a new round of virus warnings follows on the heels of a popular Christmas novelty program which many people have received as an email attachment.
The program, usually known as "Christmas Tree," comes in the form of a file called "TREE.EXE." Word on the cyberstreet is that some copies of it may harbor the dread CIH virus (also known as "Spacefiller"), which attacks PCs running Windows 95 and 98.
Warnings like the following began to appear in mid-December:
|
Sent: Monday, December 21, 1998 8:21 AM
To: Entire Office Subject: Virus! Importance: High It has been brought to our attention that a non-business related e-mail attachment, TREE.EXE, may contain the CIH Virus. This virus is said to wipe the "C" drive clean on Dec. 26th. It's a cute program where you decorate a Christmas tree, but after running it, it will remain dormant until the 26th when it will wipe out everything on your hard drive. |
The "payload delivery date" (as they say) of Dec. 26th has nothing to do with Christmas. CIH is programmed to attack on the 26th of every month. It attempts to rewrite the flash-BIOS of your computer and, if successful, renders it unbootable. It also scrambles the contents of your hard drive. Nasty bugger, eh?
As we were saying...
|
Subject: Tree.exe virus warning
Beware: Virus in file TREE.EXE TREE.EXE has been circulating as an Email attachment. It's a Christmas tree. When you open it you see a Christmas tree that asks you to click on the angel lights to decorate the tree. This lovely graphic contains a computer virus called Spacefiller which will thoroughly mess up program files on the 26th. Everybody needs to delete this graphic. Spread the word to anyone that you have already sent it on to.... If you received this file via email, you should delete the email which contained the attachment. You should delete the file (tree.exe) from wherever you saved it on your hard drive (if you saved it to disk) and empty your Recycle bin. McAfee virus scan, if you have it, should protect you from things like these. But proactive action (deleting this file) is usually the better course. |
'This appears to be an urban legend'
What's the real scoop? According to McAfee, a manufacturer of antivirus software, the TREE.EXE scare may just be a lot of hype. Here's a quote from their Website:
We have received a program called TREE.EXE from a number of customers asking if the file is infected with Spacefiller or CIH. This appears to be an urban legend going around just now. The several samples we received so far are all identical and about 2Meg in size. The first was analyzed and tested and is being used to compare to the new samples we receive. The results of our testing so far has not revealed any virus, SPACEFILLER or otherwise. This does not mean someone could not infect the same program with any virus and re-release it, either deliberately or even accidentally.
Go ahead and breathe a sigh of relief, but re-read that last sentence, too. While we know from past examples (such as the Bud Frogs Screen Saver alert) that pranksters enjoy spoiling the fun of popular downloads by falsely claiming they contain viruses, we also know that virtually any such software could be infected. Files that come to you as email attachments should be regarded as particularly suspect, because you have no way of knowing where they originated or how they may have been altered during their travels.
Based on what we know to date, odds are if you've downloaded and run TREE.EXE on your PC, you're safe. Just be aware that what you've done is inherently risky behavior, and if you don't already have up-to-date antivirus software installed on your computer, you probably should get some.
"Practice safe computing," warns McAfee. That's just plain good advice, any time of year.
For more information:
Virus Hoaxes
Current Net Hoaxes
Previous Features
